Sysmon Event ID 5

SourceSysmon

5: Process terminated

This is an event from Sysmon.

On this page

The process terminate event reports when a process terminates. It provides the UtcTime, ProcessGuid and ProcessId of the process.

Free Security Log Resources by Randy

Description Fields in 5

  • Log Name
  • Source
  • Date
  • Event ID
  • Task Category
  • Level
  • Keywords
  • User
  • Computer
  • Description
  • UtcTime
  • ProcessGuid
  • ProcessId
  • Image

Supercharger Free Edition


Centrally manage WEC subscriptions.

Free.

 

Examples of 5

Process terminated:
UtcTime: 2017-04-28 22:13:20.895
ProcessGuid: {a23eae89-bd28-5903-0000-001009665d00}
ProcessId: 12684
Image: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

 

Event XML:
 
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
        <Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" />
        <EventID>5</EventID>
        <Version>3</Version>
        <Level>4</Level>
        <Task>5</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime="2017-04-28T22:13:20.896253900Z" />
        <EventRecordID>11235</EventRecordID>
        <Correlation />
        <Execution ProcessID="3216" ThreadID="3964" />
        <Channel>Microsoft-Windows-Sysmon/Operational</Channel>
        <Computer>rfsH.lab.local</Computer>
        <Security UserID="S-1-5-18" />
    </System>
    <EventData>
        <Data Name="UtcTime">2017-04-28 22:13:20.895</Data>
        <Data Name="ProcessGuid">{A23EAE89-BD28-5903-0000-001009665D00}</Data>
        <Data Name="ProcessId">12684</Data>
        <Data Name="Image">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</Data>
    </EventData>
</Event>

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Upcoming Webinars
    Additional Resources